// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/*
//////////////////////////////////////////////////
Author : ~Hellsp@wN~
Email : alt-fox@mail.ru
OS : OllyDbg 1.10 with OllyScript plugin v0.7
Date : 24.07.2004
Version: 1.1

1) Find OEP
2) Find Stolen Bytes

Support with:
ASProtect 1.22 - 1.23 Beta 21
//////////////////////////////////////////////////
*/

var op
mov op,esp
sub op,4

var k
var l
var Stolen Bytes
var OEP
var toep

eoe lab1
eob lab1
run

lab1:
mov k,esp
add k,1C
mov l,[k]
cmp l,400000
je lab2
esto

lab2:
eob lab3
eoe lab4
bphws op,"r"
esto

lab3:
bphwc op
mov OEP,eax
mov Stolen Bytes,ebx
mov toep,eip
mov k,eax
mov l,eip
cmp l,k
je OE
eval "OEP: {OEP} and stolen bytes: {Stolen Bytes}"
cmt toep,$RESULT
sto
sto
findop toep, #55#
cmp $RESULT,0
je end
cmp $RESULT,toep
jb end
bp $RESULT
cmt $RESULT, "This is first stolen byte (may be)"
end:
ret

OE:
cmt eip, "This is OEP"
ret

lab4:
bphwc op
bphws op,"r"
esto


// [BACK] 